CVE-2023-30629: Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value

Background During the audit of Lido's Gate Seals code statemind team identified a weird behavior of the code that uses rawcall: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164 .

Construction like this: vyper success = rawcall( sealable, abiencode(SEALDURATIONSECONDS, methodid=methodid("pauseFor(uint256)")), revertonfailure=False ) was not fully documented: https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#rawcall .

The documentation says that: if maxoutsize=0 it should return nothing and then it says that if revertonfailure=False it should return a success flag in the tuple of response, but what if maxoutsize=0 and revertonfailure=False.

<img width="715" alt="image" src="https://user-images.githubusercontent.com/22330612/232125364-d2b3bbac-0b4f-40cb-80ff-f55d8eafef44.png">

So the team started researching what exactly happened in that case, after some research we found that the Vyper compiler generates the wrong bytecode in that case, it generates the sequence: CALL // call MLOAD // MLOAD is wrong since the CALL result is already stored in the stack

Impact Example of buggy code: vyper @external def returnSome(calling: address, a: uint256) -> bool: success: bool = false success = rawcall( calling, abiencode(a, methodid=methodid("a(uint256)")), revertonfailure=False )

any contract that uses the rawcall with revertonfailure=False and maxoutsize=0 receives the wrong response from rawcall. Depending on the memory garbage, the result can be either True or False.

Patches Fix by @charles-cooper https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae

Workarounds The simple workaround is always to put maxoutsize>0. Workaround example https://github.com/lidofinance/gate-seals/pull/5/files

References Lido's fix: https://github.com/lidofinance/gate-seals/pull/5/files